SPECIFICATION 



TO ALL WHOM IT MAY CONCERN: 

BE IT KNOWN that we, KOJI Chida, a subject of Japan 
and residing at Yokohama-shi, Kanagawa, Japan, KUNIO Kobayashi a 
subject of Japan and residing at Yokohama-shi, Kanagawa, Japan and 
LQKARU Morita, a subject of Japan and residing at Yokohama-shi, 
Kanagawa, Japan have invented certain new and useful improvements in 

"METHOD, APPARATUS AND PROGRAM FOR QUANTITATIVE 
COMPETITION AND RECORDING MEDIUM HAVING 
RECORDED THEREON THE PROGRAM" 
and we do hereby declare that the following is a full, clear and exact 
description of the same; reference being had to the accompanying drawings 
and the numerals of reference marked thereon, which form a part of this 
specification. 
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METHOD, APPARATUS AND PROGRAM FOR QUANTITATIVE 
COMPETITION AND RECORDING MEDIUM HAVING RECORDED 
THEREON THE PROGRAM 

5 BACKGROUND OF THE INVENTION 

The present invention relates to a method and apparatus for 
quantitative competition that compare users' aimed or intended values online, 
for example, across the Internet while holding them in secrecy and specify the 
maximum or minimum one of the intended values and only the user having 

1 0 committed it as his intended value. 

An example of the online quantitative competition is an "electronic 
sealed-bit auction scheme." With this scheme, the maximum or minimum 
value and the user having committed it as his intended value are specified, 
and techniques for holding other information in secret. This scheme is 

1 5 disclosed, for example, in Kobayashi and Morita, "Efficient sealed-bid 
auction with quantitative competition using one-way functions," ISEC99. 
Further, in H. Kikuchi, M. Harkavy and J.D. Tygar, "Multi-round anonymous 
auction protocols," IEEE Workshop on Dependable and Real-Time 
E-Commerce System, 1998, there is proposed a scheme that decides whether 

20 there is a user having committed his intended value equal to or greater than or 
smaller than a certain numerical value. The latter scheme has a disadvantage 
that when plural users have committed the maximum or minimum value as 
their intended values, those users cannot be specified and that they can detect 
a second highest or lowest numerical value. 

25 

SUMMARY OF THE INVENTION 

It is therefore an object of the present invention to provide a method 
and apparatus that compare plural users' intended values online, specify the 
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maximum or minimum one of the users' intended values with high security 
and efficiently and, if necessary, the user of the intended value corresponding 
to the specified value but keep the other users secret. 

For M integral values to be compared, their upper- and lower-limit 
5 values V M and Vi are determined in advance. In this case, V k >V k _j, where 
k=2,3 , . . . , M. Incidentally, since the maximum and minimum values are 
specified by substantially the same method, the following description will be 
given only of the case of specifying the minimum value. 

After determining his intended value V vi equal to or greater than Vj 

1 0 and equal to or smaller than V M , each user 1 1 -i (where i=l ,2, . . . , M) generates 
in a user apparatus two M-element sequences of information Sj and t s such that 
their elements corresponding to values equal to or greater than Vj and equal to 
or smaller than V vi are equal but other elements differ, and secretly sends the 
sequence of information Sj to a first quantitative competition apparatus and the 

1 5 sequence of information t; to a second quantitative competition apparatus. 
With the sequence of information s; or tj alone, it is impossible to obtain 
information about the value V V j, and hence there is no possibility of the value 
Vvi being available to any body and even to each quantitative competition 
apparatus. 

20 After the sequences of information Sj and t; (where i=l,2, . . ., N) about 

all users' intended values are obtained, the minimum value is determined. It 
can be determined by any desired procedure. An efficient scheme will be 
described below. For example, in the first place, initial values of two 
variables w min and w max are set at 1 and M, respectively, the maximum integer 

25 equal to or greater than (w min +w max )/2=(l+M)/2 is set at w, and a check is 

made to see if there is a user whose intended value is equal to or smaller than 
V w . To perform this, the first quantitative competition apparatus extracts 
w-th elements s i;W from all users' sequences of information s i5 and generates 
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Seq S)W =Si >w ||s 2s w||-.-||sN,w (where |j indicates the concatenation of data) in which 
the extracted elements are arranged in a predetermined order (for example, in 
the order of numbers pre-assigned to the users). The second quantitative 
competition apparatus extracts w-th elements t i;W from all users' sequences of 
5 information t i? and generates Seq tw =t 1 , w ||t 2 ,wl|- • • l|tN,w in which the extracted 
elements are arranged in a predetermined order. Then, Seq S;W and Seq^w are 
compared whether they are equal or not using one-way functions or 
encryption functions without revealing their values. If they differ from each 
other, it is decided that there is a user whose intended value is equal to or 

1 0 smaller than V w , then w is substituted for the variable w max , then Seq S;W and 
Seq^w are similarly generated, and they are compared. If they are equal to 
each other, it is decided that there is no user whose intended value is equal to 
or smaller than V w , then w+1 is substituted for the variable w min , and the 
above manipulation is repeated until w min =w max (=MIN), by which the 

1 5 minimum value V M in is determined. 

When w min =w max =MIN is reached, Seq s , M i N and Seq^MiN are made 
public so that every body can specify the user whose intended value is the 
minimum value Vmin- 



20 BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a diagram schematically illustrating an example of the entire 
system configuration of a first embodiment of the present invention; 

Fig. 2 is a block diagram showing examples of main functional 
configurations of a user apparatus; 
25 Fig. 3 is a flowchart showing the procedure for generating two 

sequences of information; 

Fig. 4 is a block diagram showing examples of main functional 
configurations of a quantitative competition apparatus 1 5 A; 
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Fig. 5 is a block diagram showing examples of main functional 
configurations of a quantitative competition apparatus 15B; 

Fig. 6 is a diagram schematically depicting two sequences of 
information of respective pairs; 
5 Fig. 7 is a flowchart showing the procedure for specifying the 

minimum value; 

Fig. 8 is a block diagram depicting the functional configuration of a 
user apparatus in a second embodiment of the present invention; 

Fig. 9 is a block diagram depicting the functional configuration of an 
10 information sequence generating part 33 in Fig. 8; and 

Fig. 10 is a flowchart showing the procedure that is followed by the 
user apparatus in the second embodiment. 

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
1 5 Assume that the upper- and lower-limit integral values V M and V t and 

a large prime P are already determined prior to quantitative competition. 
The prime number P is one that P-l has a large prime factor as a divisor, that 
is, a prime that is used for a cryptosystem based on a discrete logarithm 
problem. 

20 A description will be given of a first embodiment directed to a method 

with which it is possible to specify the lowest one of all bidders' intended 
values and the lowest bidder through use of two quantitative competition 
apparatuses, followed by a second embodiment that provides increased 
security in the above-mentioned quantitative competition method, and by a 

25 third embodiment that employs three quantitative competition apparatuses to 
ensure specifying the lowest one of all bidders' intended values and the lowest 
bidder even if one of the quantitative competition apparatuses goes down 
during operation. 
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First Embodiment 

Fig. 1 illustrates in block form the entire system configuration of a 
first embodiment of the present invention, which comprises user apparatuses 
5 13-1 to 13-N, quantitative competition apparatuses 15A and 15B, a bulletin 
board apparatus 21 and a database 23. The user apparatuses 13-1 to 13-N 
are each capable of communicating with the quantitative competition 
apparatuses 15 A, 15B and the bulletin board apparatus 21 through a 
communication network, and the quantitative competition apparatuses 15A 

10 and 15B are capable of communicating with the bulletin board apparatus 21. 
Reference character Y indicates information read out of the bulletin board 
apparatus 2 1 , to which the database 23 is connected. A quantitative 
competition apparatus 15C surrounded by the broken line is used in a third 
embodiment described later on. 

1 5 Each user apparatus 13-i comprises, as depicted in Fig. 2, an input part 

30, a random generating part 3 1 , a storage part 32, an information sequence 
generating part 33, an encrypting part 34, a hash function calculating part 35, 
a transmitting part 36, a control part 37, a concatenating part 38, and a sharing 
part 39. 

20 Each user 1 1 -i (where i= 1 , 2, . . . , N) determines or chooses his or her 

aimed or intended integral value V vi in the range from Vi to V M , and inputs 
the integral value to the user apparatus 13-i via the input part 30 such as a 
keyboard. The information sequence generating part 33 generates two 
sequences of information of the same number M of elements, spfsy, Sj )2 , . • 

25 Si, M } and tpfoi, t ij2 , . . ., ti sM } based on the input information V vi and a random 
number generated by the random generating part 3 1 . The number M is 
indicative of the value that the each user is allowed to choose as the intended 
value from among V] to V M ; accordingly, a series of monotone increasing 
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values Vi to V M have a one-to-one correspondence with the numbers 1 to M. 

On choosing the intended value V vi , the user 1 1-i generates the two 
sequences of information Sj and tj so that Sy^i, s^f=t^i, • • Sj )V i_i=ti )V j_i, 
Si,vi^t i)Vi , Si ;V+1 ^ti 5V+ i, . . Si s M^ti,M- That is, Sj and tj are generated so that the 
5 corresponding elements (information) in the range of from Vi to V V j are equal 
but that the corresponding elements in the range of from V vi to V M differ from 
each other. 

Fig. 3 is a flowchart showing the procedure for generating such two 
sequences of information Sj and tj. 
1 0 Step S 1 : Generate vi-1 random numbers n, r 2 , . . ., r (V i-i) each 

consisting of a predetermined number of bits, and divides these random 
numbers into two subsequnces s u , s i;2 , s i)Vi .i andt j;] , t i>2 , ti, vi ., where 
Si.m^mj m=l,2, . . . , vi- 1 . 

Step S2: Let m be vi. 
1 5 Step S3 : Generate two random numbers r s and r t . 

Step S4: Compare the two random numbers, and if they are equal, then 
return to step S3. 

Step S5: If the two random numbers differ from each other, set r s at s i>m 
and r t at t i>m and increment m by one. 
20 Step S6: If m is smaller than M, then return of step S3 . 

Step S7: If m is not smaller than M in step S6, then concatenate the 
above-mentioned two subsequences s u , s i;2 , . . ., s^-i and t^, t i;2 , . . ., t i>vi _! with 
Si,vi, s ijVi+ i, . . ., s iaM and t i)Vi , t i;Vi+1 , . . ., t ijM set by repeating steps S3 to S5, 
thereby obtaining two sequences of information s i ={s ijl , s ij2 , s i;M ) and 
25 ti={t is i, t i>2 , . . t i;M } . The two sequences of information thus obtained are 
stored in the storage part 32 in Fig. 2. 

The random generating part 3 1 generates random numbers Rlj and R2 ; , 
and pairs of information (s i5 Rlj) and (t i5 R2;) are sent secretly to the 
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quantitative competition apparatuses 15 A and 15B, respectively; for example, 
the pairs of information are encrypted with encryption functions E A and E B in 
the encrypting part 34 into encrypted sequences of information E A (Si(|Rl j) and 
E B (ti||R2i) for transmission to the quantitative competition apparatuses 15A 
5 and 15B. The encryption functions E A and E B are public-key 

cryptofunctions that only the quantitative competition apparatuses 15A and 
15B can decrypt, respectively. Further, the random generator 3 1 generates a 
random number rj as data that is used to verify the fairness of the minimum 
intended value V M in described later on, and the concatenating part 38 

1 0 generates V V j||rj that is a concatenation of the intended value V vi and the 
random number rj; furthermore, the sharing part 39 determines random 
information aj and b; such that r^a^bj (where * is an operator made public in 
advance). The operator * may be any operators that uniquely define the 
random number r 5 when the pieces of random information a { and bj are given, 

1 5 such as exclusive OR, subtraction, addition and so forth. 

The hash function calculating part 35 calculates, by a hash function h, 
hash values Hli=h(Sjj|Rli) and H2i=h(tj||R2i) for concatenations of the 
respective sequences of information and the random numbers, Si|JRli and 
ti|[R2j. The hash function calculating part 35 further calculates hash values 

20 h(aO, h(bj) and h(V V i||ri) of a i5 and V V i||ri, and sends all of these values to the 
bulletin board apparatus 21 . Incidentally, the minimum and maximum 
values Vi and V M , the two sequences of information Sj and t i5 the random 
numbers Rl; and R2 i5 the intended value V vi , the random number r { and the 
random information a; and bj are stored in the storage part 32, from which 

25 they are sent by the transmitting part 36 to the quantitative competition 

apparatuses 1 5 A, 1 5B and the bulletin board apparatus 2 1 . The control part 
37 controls reading from or writing to the storage part 32 and operations of 
the respective parts. The user apparatus 13-i may also be configured to 
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execute programs by a computer. 

Each user apparatus 13-i commits the intended value V V i by sending 
the hash values h(V V i|jrj), Hlj and H2j to the bulletin board apparatus 21 for 
publication as mentioned above. This means that each user registers V v i as 
5 his intended value without making it public. As a result, the intended value 
V vi is made unchangeable thereafter, and when a value equal to or larger than 
the intended value V vl - is made public as the minimum value Vmin in the 
bulletin board apparatus 2 1 for some reason, each user apparatus makes 
public the pairs of information (s ; , Rlj) and (t;, R2i), or (V V i||ri) to indicate that 

10 the intended value V vi is equal to or smaller than the minimum value Vmin, 
thereby verifying that the published minimum value V M in is cheating. It is 
for the reasons given below not to singly hash the information sequences Sj 
and tj to be sent to the bulletin board apparatus 2 1 but instead to hash their 
concatenations with the random numbers Rl; and R2j. That is, letting 

1 5 HI j=h(Si) and H2i=h(ti), if the number of bits of each element of the 

information sequences Sj and tj are decreased for the purpose of reducing 
channel capacity and another user learns either one of the sequences of 
information s 5 and tj by some means, then the user could easily estimate the 
other information sequence (the knowledge of Sj and tj may enable the user to 

20 know the value V V j); therefore, the above scheme is intended to prevent such 
leakage of the information sequences and hence provide increased security for 
the quantitative competition apparatuses 15A and 15B. In practice, however, 
the security may be diminished to some extent, and if the number of bits of 
each element is large, the random numbers Rl ; and R2j may be omitted. 

25 The quantitative competition apparatuses 15A (and 15B) comprise, as 

shown in Fig. 4 (and Fig. 5), receiving parts 40 A (40B), decrypting parts 37A 
(47B), storage parts 4 1 A (4 IB), random generating parts 42 A (42B), hash 
function calculating parts43A (43B), modular exponentiation parts 44A (44B), 
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transmitting parts 45 A (45B), and control parts 46 A (46B). 

In the quantitative competition apparatus 15Athe encrypted sequence 
of information E A (s;||Rli) received in the receiving part 40A is decrypted in 
the decrypting part 47A into Sj||Rl 5 (where i=l, N), and if necessary, the 
5 decrypted information s { |jRlj is hashed in the hash function calculating part 
43 A to obtain a hash value h(Sij|Rli); it is possible to verify that the hash value 
matches the value HI j made public in the bulletin board apparatus 2 1 . The 
sequences of information Si to s N and the random numbers Rl! to Rl n are 
separated from the value Si||Rli and are stored in the storage part 41A. In the 

1 0 storage part 4 1 A there is also prestored the afore-mentioned large prime R 
The bulletin board apparatus 21 stores information received from the 
user apparatuses 13-1 to 13 -N and the quantitative competition apparatuses 
15A and 15B in the data base 23, which is accessible from any apparatuses. 
In the quantitative competition processing the bulletin board apparatus 21 

1 5 decides whether the pieces of information sent from the quantitative 

competition apparatuses 15A and 15B match each other, and based on the 
result of decision, updates the value w to be provided to the quantitative 
competition apparatuses 1 5 A and 1 5B. Since the bulletin board apparatus 2 1 
performs only such functions, their functional configurations are not shown. 

20 Upon completion of transmission of the encrypted sequences of 

information E A (si||Rli) and E B (si||Rli) and the hash values Hl i5 H2 i? h(V vi ||r;), 
h(aj) and h(bj) from every user 13-i (where i=T, . . ., N), for example, the 
bulletin board apparatus 21 sends to the quantitative competition apparatuses 
15A and 15B an initial value V w that is the maximum integer equal to or 

25 larger than (w min +w max )/2=(l +M)/2 where w min and w max are two integral 
variables and have their initial values set at 1 to M, respectively, the initial 
value V w being received in the receiving parts 40A and 40B. The 
quantitative competition apparatus 15A generates, as depicted in Fig. 4, a 
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random number RA W in the random generating part 42A, then reads out of the 
storage part 41 A those elements S; ;W in the sequences of information Sj 
received from all the user apparatuses 13 which correspond to the value w, 
and generates, by a sequence generator 48A, Seq SjW =Si jW ||s2 )W ||...||s N)W , which is 
5 a concatenation of the read-out elements arranged in the order of the users 
11-1, 11-2, . . . , 1 1 -N. The hash function calculating part 43 A calculates a 
hash value HS w =h'(Seq S;W ) for the element concatenation Seq S;W by a hash 
function h' and a hash value HA w =h(RA w ||HS w ), by a hash function h, for a 
concatenation RA w j|HS w of the random number RA W and the hash value HS W 

1 0 produced by a concatenator 49A. The hash value HS W and the random 

number RA W are input to the modular exponentiation part 44A for calculating 
CA w =HS w RAw (mod P), and a pair (HA W , CA W ) is sent from the transmitting 
part 45 A to the bulletin board apparatus 21 , wherein it is made public. The 
hash function h' is a one-way function that maps a given value over a finite 

1 5 field uniquely and randomly. The hash function h is a general-purpose 
function like SHA-1. 

The quantitative competition apparatus 15B generates, as depicted in 
Fig. 5, a random number RB W in the random generating part 42B, then reads 
out of the storage part 41B those elements ti, w in the sequences of information 

20 ti received from all the user apparatuses 13 which correspond to the value w, 
and generates, by a sequence generator 48B, Seqt jW =ti, w ||t 2 ,w||---l|tN,w 5 which is 
a concatenation of the read-out elements arranged in the order of the users 
11-1, 11-2, . . . , 11 -N. The hash function calculating part 43B calculates a 
hash value HT w =h'(Seq t;W ) for the element concatenation Seq^w by a hash 

25 function h' and a hash value HB w =h(RB w ||HT w ), by a hash function h, for a 
concatenation RB W |[HT W of the random number RB W and the hash value HT W 
produced by a concatenator 49B. The hash value HT W and the random 
number RB W are input to the modular exponentiation part 44B for calculating 
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CB^HT/^mod P), and a pair of values (HB W , CB W ) is sent from the 
transmitting part 45B to the bulletin board apparatus 21, wherein it is made 
public. 

Next, the quantitative competition apparatus 15 A reads the 
5 information CB W made public by the bulletin board apparatus 21 , then inputs 
it to the modular exponentiation part 44A, then calculates CB w RAw by the 
random number RA W , and sends the calculation result to the bulletin board 
apparatus 21 . Similarly, the quantitative competition apparatus 15B also 
reads CAwHHSw^Cmod P) made public by the bulletin board apparatus 21 , 

1 0 then inputs it to the modular exponentiation part 44B to calculate 

CA w ^ w KHS w ^ w )^ w (m°d P)> and sends the result of calculation to the 
bulletin board apparatus 21. 

Fig. 6 schematically shows in vertical form the sequences of 
information s, and t; (where i=l, N) that each user apparatus 13-i generates 

15 in the information sequence generating part 33. In a given pair (s i>m , ti, m ) of 
the corresponding elements in each pair of sequences of information s i ={Si ) i, 
Si ;2 , • ■ s i>nw . . ., s ijM } and ti={t u , t i>2 , . . ., t i>m , . . t ijM }, the straight-line portions 
represent subsequences where s i;m = \ m , and the zigzag portions represent 
subsequences where Sj >m ^ t i;in . For example, when the value m=w passes 

20 through the straight-line portions of all pairs of sequences of information s^ 
and tj as shown, (s i!W ||s 2 , w ||. . .||s N , w )=(ti, w ||t2,wl|. . .||t N>w ), that is, Seq S;W =Seq t;W , and 
consequently, it can be seen that h'(Seq S;W )= hXSeq^), that is, HS W =HT W . 
However, if the value w is high enough to pass through the zigzag portions of 
at least one pair of sequences of information S; and t i5 the likelihood of 

25 HS W =HT W is negligibly little since (s;, w ||s 2;W || . . • ||s N , w Mti, w ||t 2;W ||. . . ||t NjW ). 
Accordingly, HS^fflV 

When HS W =HT W , the values (HT W ^^(mod P) and 
(HS w RAw ) RBw (mod P) sent to the bulletin board apparatus 21 are equal to each 
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other. Since P is a large prime and since P-l has a large prime factor as its 
divisor, the likelihood of the values (WT^f** (mod P) and 
(HSw^f^Cmod P) being equal is negligibly little when HS W *HT W . 
Accordingly, when (HT/^^mod P)=(HS w RAw ) RBw (mod P), since s 1)W =t Uw , 
5 S2, w =t2,w> • • •> Sn.w^n^wj it holds that Sj jm =tj ;m (where m=l, . . w) for each i and 
the intended value V vi is not included in first to w-th values Vi to V w among 
M values Vi to V M ; therefore, the minimum intended value V M in is not 

Li 

□ included. In other words, the minimum intended value is present in the 

m range of (w+1 )-th to M-th values. It can be seen that when 

U 1 0 (HTw^f^mod P)^(HS w RAw ) RBw (mod P), the probability of the minimum 

2 intended value being present in the w-th and subsequent values is 

U overwhelmingly high. 

The bulletin board apparatus 21 makes the above comparison, then 
substitutes w+1 for the variable w min or w for the variable w max depending on 
fS 1 5 whether (HT w RBw ) RAw (mod P) and (HS w RAw ) RBw (mod P) are equal or not, and 
repeats the above manipulation. After approximately log M rounds of 
manipulation, w max =w min (=MIN). In this instance, the MIN-th value Vmin in 
the range from Vj to V M is the minimum intended value. 

Fig. 7 shows the procedure of searching for the minimum value 
20 described above. 

Step SI : The bulletin board apparatus 21 initializes the variables w min 
and w max at 1 and M, respectively, then calculates the maximum integer w 
equal to or smaller than (w min +w max )/2, and sends the value w to the 
quantitative competition apparatuses 15 A and 15B. 
25 Step S2A: The quantitative competition apparatus 15A generates the 

element concatenation Seq SjW and the random number RA W , then calculates the 
hash values HS w =h'(Seq S;W ) and HA w =h(RA w ||HS w ) and the modular exponent 
CA w =HS w RAw (mod P), and sends (HA W , CA W ) to the bulletin board apparatus 
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21. 

Step S2B: Similarly, the quantitative competition apparatus 15B also 
generates the element concatenation Seq t)W and the random number RB W5 then 
calculates the hash values HT w =h'(Seq t , w ) and HB w =h(RB w ||HT w ) and the 
5 modular exponent CB w =HT w RBw (mod P), and sends (HB W , CB W ) to the 
bulletin board apparatus 21. 

Step S3 A: The quantitative competition apparatus 15A reads out CB W 
from the bulletin board apparatus 2 1 , then calculates 
g CB/^mod P=(HT w RBw ) RAw mod P, and sends it to the bulletin board 
g 10 apparatus 21. 

'V Step S3B: The quantitative competition apparatus 15B reads out CA W 

f ° from the bulletin board apparatus 2 1 , then calculates 
g CAw^mod PKHS w RAw ) RBw mod P, and sends it to the bulletin board 
apparatus 21. 

W 

O 15 Step S4: The bulletin board apparatus 21 makes a check to determine 

if (HTw^Y^mod P and (HSw^Y^mod P match each other. 

Step S5: If they match, the bulletin board apparatus 21 substitutes w min 
for w w +l. 

Step S6: If they do not match, the bulletin board apparatus 21 
20 substitutes w max for w w . 

Step S7: A check is made to see if w max =w min , and if not, the procedure 
returns to step SI, followed by repeating steps S2A, S2B, S3 A, S3B, S4, S5 
and S6. 

Step S8: If w max and w m i n are equal in step S7, then w min =MIN and the 
25 value corresponding to the number MIN, as the minimum intended value V min 
are both made public. The quantitative competition apparatuses 1 5A and 
15B send to the bulletin board apparatus 21 the element concatenations 
Seq S)M iN and Seq t)MIN corresponding to the number MIN, thereby making it 
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possible to specify a user 1 1 -j that the corresponding elements Sj 3 MiN and tj ;M iN 
in the two element concatenations differ from each other. 

This means that the minimum intended value V MIN among the 
intended values V vl to V vN of the users 11-1 to 11-N has been obtained. 
5 After detecting the minimum intended value V M in the quantitative 

competition apparatuses 15Aand 15B send to the bulletin board apparatus 21 
Seq S)M iN, RAmin, Seq t; min and RBmin obtained when w m j n =w max : =MIN. As a 
result, all the users 11-1 to 1 1-N are allowed to compare the corresponding 
elements s i5 MiN and t i>M iN of the two element concatenations Seq S;M iN and 

1 0 Seq t M!N f°r each i=l , . . . , N and learn that the user 1 1 -j corresponding to the 
j-th portion containing information s^min^min has set the minimum intended 
value V M in as his intended value V vj . With the order of arrangement of 
Seq S;MIN and Seqt, min known, it is possible to specify the above-mentioned j-th 
user 11-j determined in step S8. 

1 5 In this embodiment the quantitative competition apparatus 1 5A 

receives from the user 11-i (where i=l, N) the random information a { that 
is ri=ai*b;, whereas the quantitative competition apparatus 15B receives the 
random information b { from the user 1 1 -i. The bulletin board apparatus 2 1 
receives h(a { ), h(bj) and h(V v j||ri) from each user 11-i. Accordingly, if the . 

20 quantitative competition apparatus 1 5 A happens to know the random number 
ri for every user prior to the search for the minimum intended value V M in> 
V w =V vi that matches h(V vi ||ri) made public can be found out by calculating 
h(V w ||ri) sequentially from V! to V M for each i, and consequently, the 
quantitative competition apparatus 15B detects the minimum intended value 

25 V M in before the bulletin board apparatus 21 begins to search for the vale 
V M iN~this is undesirable from viewpoint of security. In the first 
embodiment, however, since the pieces of random information ai and bj that 
ri=ai*bi are provided separately to the quantitative competition apparatuses 
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15A and 15B, neither of them can singly search for the value V M in- 

After the detection of the minimum intended value V M in the validity of 
the value made public in the bulletin board apparatus 21 can be verified as 
described below. 

5 The values h(aj), h(bj) and h(V vj ||rj) of the user 1 1 -j are already made 

public. The quantitative competition apparatuses 15A and 15B respectively 
send the random information aj and bj to the bulletin board apparatus 21, in 
m which they are made public. Each user apparatus 13-1 uses the published 
O values V V j=V M iN to calculate h(VMiN||aj*bj) and verifies whether 
p 1 0 h(V M iN||aj*bj)= h(V v j||rj). A mismatch means that the user 1 1 -j, or the 
J quantitative competition apparatus 15 A or 15B has cheated. Then, the 
values h(aj) and h(bj) are calculated from aj and bj, and a check is made to 
determine whether they match the published values. If a mismatch is found, 

H it can be decided that the quantitative competition apparatus has cheated 

59 

tJ 15 which sent that one of the pieces of random information aj and bj which does 
not match the corresponding value. If the both values match the published 
values, it can be decided that the user 1 1-j having sent the published value 
h(V V j||rj) has cheated. 

As described above, by determining the random information a, and b s 

20 such that r^a^b; and keeping h(aj), h(b 5 ) and h(V vi ||ri) public in the bulletin 
board apparatus 21, each user can verify the validity of the random 
information aj, bj sent from the quantitative competition apparatuses 15Aand 
1 5B to the bulletin board apparatus 21 . This produces the same effect as is 
obtainable in the case where the user 11-i attaches his signature to the random 

25 information a i5 bj to guarantee their validity as long as it is proved that the 
verification information h(ai), h(bj) made public by the bulletin board 
apparatus 21 is about the user 11-i; furthermore, this scheme has advantages 
that the computational complexity involved is less than in the case of using 
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the signature scheme and that the user does not require any signature means. 
Incidentally, it is desired in terms of security the random number r { be 
sufficiently large. 

In the first embodiment, a person who knows HT W may estimate HS W , 
5 and if it is correct, he can detect another user's intended value, but since P is a 
large prime and since P-l has large prime factor as its divisor, it is difficult to 
calculate RA W of HS^^mod P; hence, it is impossible to determine whether 
the estimated value HS W is truly correct. Accordingly, every user cannot 
find out any other user's intended value. 

10 By making RA MIN and RB M in public at last and using them and the 

element concatenations Seq SjMIN and Seq^MiN, it can be verified whether fair 
quantitative competitions have been made. 

In the quantitative competition apparatuses 15A and 15B, reading 
from and writing to the storage parts 41 A and 4 IB, processing of received 

1 5 information, transmission of various information via the transmitting parts 
45A and 45B to respective apparatuses and the operations of the respective 
parts are laced under the control of the control parts 46 A and 46B. The 
quantitative competition apparatuses 15A and 15B can also be functioned 
through executions of programs by a computer. 

20 Though its functional configuration is not shown in particular, the 

bulletin board apparatus 21 is provided with a transmitting-receiving part for 
communication with each user apparatus and the quantitative competition 
apparatuses 15A and 15B, and stores received information in the database 
(Fig. 1). When requested, the bulletin board apparatus 21 reads out the 

25 requested information from the database 23 for transmission to the apparatus 
having made the request; furthermore, the apparatus 21 transmits and receives 
information necessary for the procedure of Fig. 7 and for its execution. The 
bulletin board apparatus 21 can also be functioned through execution of 
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programs by a computer. 

The first embodiment has been described above to determine the 
minimum value V M in among all users' intended values V vi with the numbers 1 
to M made to correspond with the values Vi to V M in ascending order, but by 
5 making the numbers 1 to M correspond with the values V] to V M in 

descending order, the maximum value Vmax among all of the intended values 
V; can also be determined using the above-described algorithm intact. That 
S is, letting vi represent the number corresponding to the intended value V vi , the 
fpf two sequences of information Sj and t; need only to be generated so that, for 
rS 10 the numbers 1 to M, s ijW =t i;W or s i)W ^t i;W depending on whether the number 

element w is equal to or greater than 1 but smaller than vi or equal to or 
;L greater than vi but smaller than M. In short, only by arranging the values V! 

K to V M upside down in Fig. 6, it can be seen that the determination of the 
CO number MIN which provides the minimum intended value V M in is the same as 

Hj 15 the determination of the number MAX which provides the maximum intended 
value Vmax- That is, in the first embodiment described above, if the order of 
numbering the values Vi to V M is reversed to M to 1 and the number MIN is 
replaced with the number MAX, Fig. 7 will be the quantitative competition 
procedure of searching for the maximum intended value Vmax- This applies 
20 to the embodiments described later on. 

Second Embodiment 

In the above-described first embodiment, if a certain user 1 1-i 
conspires with either one of the two quantitative competition apparatuses, the 
25 user 1 1-i, though having committed the intended value V vi , could secretly 
abandon the game (withdrawal of his bidding). The abandonment of the 
game mentioned herein means that the user 1 1-i will not be determined to 
have committed the minimum V M in (will not be a winning bidder) regardless 
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of his committed intended value V vi , that is, irrespective of whether the value 
V vi is the minimum among all the users' intended values V v i, V v2 , . . ., V vN . 

For example, in the case where the user 1 1 -i conspires with the 
quantitative competition apparatus 15B and, each time supplied with w from 
5 the bulletin board apparatus 21, embeds not the sequence element t i;W of the 
user 1 1-i but the value of the sequence element s i;W from the user 1 1-i in the 
element concatenation Seq^w in step S2B of the Fig. 7 quantitative 
£ competition procedure to thereby alter the sequence s i)W ^t i;W to s i)W =t ijW , even if 
O the intended value V vi of the user 1 1-i is the minimum value V M in> the user 
O 10 1 1 -i will not be determined to have committed the minimum value V M in in the 
= p search for the minimum value by the bulletin board apparatus 2 1 but instead 
any one of the other users will be determined to have committed the minimum 
value Vmin- Such a determination cannot be said to be fair. Since the 
m afore-mentioned fairness verification scheme verifies h(V v j||rj) and h(aj||bj) 

bj 1 5 only for the intended value V V j determined as the minimum value VMIN and 
published and the user 11-j, it is impossible to detect the cheat by a conspiracy 
between the user 1 1-i and the quantitative competition apparatus 15B. 

A description will be given below of a second embodiment adapted to 
prevent a cheat by such a conspiracy between a user and a quantitative 
20 competition apparatus. 

The second embodiment features the method for generating the 
sequences of information Sj and tj of each user 1 1-i in the first embodiment. 
In this embodiment, an m-th element of each of the M-element sequences 
Si = {si,i, . . ., s i;M } and ti={t u , . . ., t i;M } is generated based on information about 
25 all elements preceding the m-th element. Accordingly, in the case of the 
sequence Sy, . . ., Syyf, if the m-th element s i>m is replaced with t i;in or some 
other value s\ m , the element s\ m is not based on the information about the 
elements s u , s i)2 , . . ., s\ m , . . s ijM preceding it, and the subsequent elements 
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Si, m +h Si,M are not based on the elements preceding the element S;, m , either, 
and consequently, such a malicious replacement can be detected. The 
second embodiment will be described below concretely. 

Fig. 8 illustrates in block form the configuration of the user apparatus 
5 13-i adapted for the quantitative competition according to the second 

embodiment. In this embodiment the concatenating part 38 and the sharing 
part 39 in the Fig. 2 configuration are removed and the information sequence 
q generating part 33 has such a configuration as depicted in Fig. 9. The 
fjj random generating part 3 1 generates, as in the Fig. 2 embodiment, the random 
10 numbers Rlj and R2j, and further generates initial random numbers s i)M +i, 
tj M+i, cai and cbi. Based on these initial random numbers, the information 

_§*= 

L. sequence generating part 33 generates s ijM , s i)M _i, . . ., s i;! , Sj 5 o and t- uM , tj sM _i, . . ., 
H tj sl in a sequential order. 

Li 

81 Fig. 9 shows an example of the configuration of the information 

fy 15 sequence generating part 33, which is shown to comprise hash calculators 
33-1 A and 33-1B, concatenators 33-2Aand 33-2B, hash calculators 33-3A 
and 33-3B, and a concatenator 33-4. The hash calculators 33-1 A and 33-1B 
are supplied with the initial random numbers ca; and cb i5 respectively, then 
calculate their hash values h(caj) and h(cb ; ), and in the next and subsequent 
20 rounds of calculation repeats calculating hash values of the calculation results 
each time. The concatenator 3 3 -2 A concatenates the past sequence of 
information Si of the preceding rounds of calculation with the current outputs 
from the hash calculators 33-1 A and 33-1B. The concatenator 33-2B 
concatenates the sequence of information tj of the preceding rounds of 
25 calculation with the current outputs from the hash calculators 33-1 A and 

33-1B. The hash calculators 33-3A and 33-3B calculate hash values of the 
outputs from the concatenators 3 3 -2 A and 33-2B, respectively, and output the 
hash values as the current sequence elements s i>m and ti, m . The outputs from 
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the hash calculators 33-1 A and 33- IB, which are input to the concatenators 
33-2A and 33-2B for an m-th round of hash calculation by the hash 
calculators 33-3 A and 33-3B, are the outputs by an (m+l)-th round of hash 
calculation. 

5 In the process for generating the subsequences s i>m and t i;m that are not 

equal, the initial random numbers s i)M +i and t isM +i are input as initial values of 
the sequences of information S; and t ; to the concatenators 33-2A and 33-2B, 
then the first-round outputs from the hash calculators 33-1 A and 33- IB are 
input to the both concatenators 33-2A and 33-2B, and the hash values output 
10 from these concatenators are provided as sequences Sj and tj of information of 
the second and subsequent rounds of calculation to the concatenators 3 3 -2 A 
and33-2B. 

Upon completion of the generation of the subsequences from m=M to 
m=v, the output s i;Vi [|tj )V i from the concatenator 33-4 for m=vi— 1 corresponding 
15 to the intended value V vi is input as the sequences of information s ; and t ; to 
the concatenators 33-2A and 33-2B, respectively, and the concatenated 
outputs are provided to the hash calculators 33-3A and 33-3B for calculating 
their hash values. In this process, since the same sequence of information 
Si,vi||ti,vi as the outputs from the hash calculators 33-1A and 33-1B are provided 
20 to the both concatenators 33-2A and 33-2B, the outputs s i>m and t i>m from the 
hash calculators 33-3 A and 33-3B for m=vi-l are equal to each other. 

Thereafter, the outputs s i>m and t i)m from the hash calculators 33-3A and 
33-3B are input again as sequences of information to the concatenators 33-2A 
and 33-2B, and hash calculations are repeated sequentially for m=vi-2, vi-3, 
25 . . ., 0, by which the subsequence s i>m =tj, m is generated. 

Fig. 10 is a flowchart of the procedure to be followed by the user 
apparatus 13-i in the second embodiment. 

Step SI : Generate the initial random numbers Rl i5 R2 i? ca i5 cb i5 s 5jM +i 
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and t i>M+1 . 

Step S2: Set an initial value m at M, then sequentially calculate, for 
the element number vi corresponding to the intended value vi, 
s i , m =h(s ] - m+3 ||h M+1 - ra (ca i )||h M+, - m (cb i )) 

for m=M, M-l, vi, and store the calculation results as subsequences 

S^m^t^m- 

^ Step S3: Calculate 

o 

g Slm = t ijm = hC^l^llh^^CcaOllh^CcbO) 

ui 

0 10 for m=vi-l and store it. 

1 Step S4: Calculate 

T s ijm = t ijm = Ks^^llh^^CcaOllh^ 1 - 111 ^)) 

O 

sequentially for m=vi-2, vi-3, . . ., 0 and store it as subsequences Sj jm =t i)m . 
m Step S5: Encrypt Rl ; and Si={s i; i, s is 2, . . s i)M }, then send the resulting 

St 15 E A (si||Rli) to the quantitative competition apparatus 15A, then encrypt R2j and 
ti = {tj,i, t i)2 , . . t ijM }, and send the resulting E B (tj||Rl { ) to the quantitative 
competition apparatus 15B. 

Step S6: Send HlrhCsjjlRlO, ffirhftl^j), s ij0 , h M+I (c ai ) andh M+1 (cbj) 
to the bulletin board apparatus 21 for publication. 
20 The quantitative competition processing, that is, the processing of 

searching for the minimum intended value V M in, by the bulletin board 
apparatus 21 and the quantitative competition apparatuses 15 A and 15B is the 
same as described previously with reference to Fig. 7. 

After specifying the minimum value V MIN , the bulletin board 
25 apparatus 21 calculates the hash values h(caj) and h(cbj) from the user 

apparatus 13-i (M+l-MIN) times to obtain h M+1_MIN (caO and h M+1_MIN (cbi) 
(where i=l ,2, . . ., N), which are made public. The validity of these values is 
guaranteed by verifying whether the values obtained by further calculating 
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them MIN times match the published information h M+1 (caO and h M+1 (cbi). 
Moreover, since s i;M iN, ti, M iN, h M+1_MIN (ca;) and h M+1-MIN (cbj) of each user are 
made public by a winner (successful bidder) specifying phase, any user can 
equally calculate s i;0 by executing step S4 through utilization of the published 
5 information. 

If the user 1 1-i and the quantitative competition apparatus 15A or 15B 
conspire to replace s i;W and tj, w for Sj ;M iN and t i;M iN as described previously, a 
q value different from s i;0 is usually calculated. In other words, the 
S replacement is detected. But this verification is inefficient on the order of 
-~i 1 0 MN that is the product of the choosable number M of intended values and the 
f: number N of users. However, since the primary object is to determine the 

2 winner and his intended value, this "fairness verification phase" of the loser is 

Q 

not essential, and in practice it needs only to be performed after completion of 
CB the protocol. 

m 15 

Third Embodiment 

In the first and second embodiments two quantitative competition 
apparatuses and each user apparatus generates two sequences of information 
Si and tj. This embodiment uses three quantitative competition apparatuses, 

20 including the third quantitative competition apparatus 15C surrounded by the 
broken line in Fig. 1 . Each user generates three sequences of information s is 
tj and u ; in the same manner as in the afore-described embodiments such that 
Si, m = ti,m = Ui 3m for m=l, 2, . . ., vi-1 and s^t^u^ for m=vi, vi+1, . . ., M where 
vi corresponds to the intended value V vi , and secretly sends each of them to 

25 one of the three quantitative competition apparatuses, and as is the case with 
the first embodiment, the quantitative competition processing is carried out by 
two quantitative competition apparatus and the bulletin board apparatus. In 
this instance, when one of the two quantitative competition apparatuses goes 
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down, the third quantitative competition apparatus carries on the processing 
of the failing apparatus. This embodiment is identical in basic operation 
with the first embodiment, and hence it will be described with reference to the 
drawings showing the first embodiment. 
5 The user 1 3 -i (where i=l ,2, . . . , N) determines the intended integral 

value V V i equal to or greater than Vi and equal to or smaller than V M , and 
generates, by the information sequence generating part 33 in the user 

M= apparatus 13-i of Fig. 2, three sequences of information s ; , t; and Uj such that 

D 

O pieces of information corresponding to the values in the range from Vi to V vM 

m 

o 10 are all equal but pieces of information corresponding to the values in the 
J range from V vl to V M are all different. Further, the user generates random 
1~ numbers Rl h R2 b R3j and r 5 in the random generating part 3 1 , and determines 
rf random information a i5 bi and cj such that ri=ai*bi*C}. A pair of information 
U (sj, Rlj) and the information a is a pair of information (tj, R2i) and the 
O 1 5 information b;, and a pair of information (u i5 R3i) and the information q are 
sent secretly (in encrypted form) to the quantitative competition apparatuses 
1 5A, 1 5B and 1 5C, respectively. Moreover, hash values HI i=h(si||Rli), 
H2i=h( t ||R2i) and H3 i =h(u i ||R3 i ) of concatenations Si||Rl b ti|jR2i and u i j|R3 i of 
the respective pairs are calculated using the hash function h; hash values h(aO, 
20 h(bi) and h(Cj) of the random information and a hash value h(Vi|jri) of the 
intended value V V i and the random number rj are calculated; and hash values 
h(aj), h(bi) and h(cO of the random information and a hash value h(Vi||ri) of the 
intended value V vi and the random number r { are calculated. These hash 
values are sent to the bulletin board apparatus 21, wherein they are made 
25 public. 

Each user 1 1-i commits the value V vi by sending the hash values HI i? 
H2j, H3j and h(Vi|[rj) to the bulletin board apparatus 21 and making them 
public. As a result, the intended value is no longer changeable, and if a 
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value larger than the intended value V vi is determined to be the minimum 
value for some reason, the user can prove, by making public at least two of 
three pairs of information (s i? Rlj), (t i5 R2j) and (uj, R3;), that his intended 
value is qualified as the minimum value. Assume that the random number rj 
5 can be calculated when two of three pairs of information are known. 

Since the subsequent quantitative competition processing can be 
performed by the bulletin board apparatus 21 and two quantitative 
ul competition apparatuses as described previously with reference to the first 
g embodiment, the Fig. 7 procedure is followed using two quantitative 
-_ 10 competition apparatuses, for example, 15A and 15B. 
W J That is, the bulletin board apparatus 21 first sends the maximum 

integer w equal to or smaller than (w min +w max )/2=(l+M)/2 as an initial value 
O to the both quantitative competition apparatuses 15A and 15B. The 
M= quantitative competition apparatus 15 A generates a random number RA W , 

o 1 5 then extracts elements Sj w of the s r sequences of information received from all 
user apparatuses, and generates an element concatenation 
Seqs >w =si >w ||s2, w ||...||sN, w such that the extracted elements are arranged in the 
order of users 11-1, 11-2, . . . , 1 1 -N. Further, the quantitative competition 
apparatus 15 A calculates a hash value HS w =h'(Seq SiW ) by the hash function h', 
20 a hash value HA w =h(RA w j|HS w ) by the hash function h, and a modular 

exponent CAw^HSw^^mod P), and sends a pair of information (HA W , CA W ) 
to the bulletin board 2 1 . The quantitative competition apparatus 1 5B 
generates a random number RB W , then extracts elements t ijW of tj-sequences of 
information received from all the user apparatuses, then generates an element 
25 concatenation Seq t;W =ti jW ||t 2) w|| • • • Ifo, such that the extracted elements are 
arranged in the order of users 11-1, 11-2, 1 1-N, then calculates a hash 
value HT w =h'(Seq tjW ) by the hash function h', a hash value HB w =h(RB w ||HT w ) 
by the hash function h, and a modular exponent CB^HTw^^mod P), and 
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sends a pair of information (HB W , CB W ) to the bulletin board 21. 

Next, the quantitative competition apparatus 15 A reads the modular 
exponent CB w =HT w RBw (mod P) made public by the bulletin board apparatus 
21, then calculates CB/^mod P= (HT w RBw ) RAw (mod P), and sends it to the 
5 bulletin board apparatus 21 . The quantitative competition apparatus 1 5B 
reads the modular exponent CA^HSw^Cmod P) made public by the bulletin 
board apparatus 21, then calculates CA^mod P= (HS w RAw ) RBw (mod P), and 
g sends it to the bulletin board apparatus 2 1 . 
| If HS W and HT W are equal, then (HT^^mod P) and 

Q 10 (HS w RAw ) RBw (mod P) are equal, and since P is a large prime and P-l has a 
Hp large prime factor as its divisor, there is little possibility that HS W and HT W 

differ and (HT/^f^mod P) and (HS w ^ w ) Mw (mod P) become equal. 
P Accordingly, it can be seen that when (HT w RBw ) RAw (mod P) and 

Li 

m (HSw^^^mod P) are equal, the minimum intended value V MIN is equal to 

| 15 or greater than V w+ i, whereas when they differ, the value V M in equal to or 

smaller than V w . If they are equal, w+1 is substituted for the variable w min , 
and if they differ, w is substituted for the variable w max , after which the above 
manipulation is repeated. By repeating the manipulation about log M times, 
w max =Wmin( == MIN) is obtained. The value V M in thus obtained is the 
20 minimum intended value. In the following description, MEN will be used as 
the element number corresponding to V M in in the sequences of information sj 
and t; as in the case of Fig. 6. 

After detecting the minimum intended value V M in, the quantitative 
competition apparatuses 15 A, 15B and 15C send aj, Seq S;M iN and RAmin, bj, 
25 Seq^MiN and RB MIN , and only c j3 respectively, to the bulletin board apparatus 
21, y which they are made public. By this, all the users can detect that the 
user corresponding to that common position of the two sequences holding 
different pieces of information is the user 1 1 - j having committed V MIN as his 
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intended value. 

Suppose, for example, that the quantitative competition apparatus 15B 
goes down in the above process. Since the information possessed by the 
quantitative competition apparatus 15B and the information by the 
quantitative apparatus 15C are essentially identical, the latter can take over 
the operation of the former. 

The fairness of the minimum intended value V MIN made public in the 
bulletin board apparatus 21 can be verified, for example, through utilization 
of such secret sharing techniques as disclosed in Shamir. A, "How to Share a 
Secret," Comm. Assoc. Comput. March., vol. 22, no. 11, pp.612-613 (Nov. 
1 979). That is, for the values H(Aj), H(Bj) and H(Cj) committed by the user, 
the user's committed values A j5 Bj and Q can be disclosed by the cooperation 
of at least two of the three quantitative competition apparatuses. That is, 
H(Vmin||Aj*Bj*Cj) can be verified. 

After sending the concatenation elements Seq s , M iN and Seq^MiN from 
the quantitative competition apparatuses 15A and 15B to the bulletin board 
apparatus 21 for publication, that one of Seq SjZ and Seq u (where z=l,2, . . ., 
MIN) which was used for quantitative competition may be sent to the bulletin 
board apparatus 21 to reveal that V M in is valid. 

As described above, according to the present invention, the 
quantitative competition apparatuses 15 A and 15B extract from the respective 
sequences $ and tj (where i=l, . . ., N) the elements s ijW and t ijW corresponding 
to the value w specified by the bulletin board apparatus 21, then create the 
element concatenations Seq s , w and Seqt, w with the extracted elements arranged 
in predetermined orders, then compare the element concatenations without 
revealing them, then decide whether there is a user having his intended value 
equal to or smaller than V w (equal to or greater than V w in the case of 
detecting the maximum value) depending on whether the concatenations are 
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equal or different, and change the value w based on the result of decision. 
The quantitative competition apparatuses 15A and 15B need not always use 
the modular exponents CA^HSw^mod P) and CB w =HT w RBw (mod P), in 
which case they generate only HS w =h(Seq S;W ) and HT w =h(Seq t!W ) in steps S2A 
5 and 2B in Fig. 7, then send them to the bulletin board apparatus 2 1 , and in 
step S4 compare them to decide whether they match each other. In this 
instance, however, if each element of the sequences Sj and tj is 
simple-configured with one bit, for instance, then the element concatenation 
Seq s , w becomes simple, for example, (0||1||1||0||1||0||0). By producing the 

10 concatenation Seq S;W of an arbitrary bit string and calculating its hash value, it 
becomes easy to find, by trial and error, a bit string that matches the published 
HS w =h(Seq SjW ). Therefore, too much a simple element configuration is not 
preferable in terms of security. On the other hand, in the case of hiding the 
values HS W and HT W by concatenating them with the random numbers RA W 

1 5 and RB W , respectively, and hashing them as in the Fig. 7 embodiment, the 
1-bit elements of the sequences s\ and tj do not present any problem in terms 
of security. The 1-bit configuration of each element of the sequences S; and 
tj permits reduction of the amount of data for the encrypted information 
E A (Si||Rlj) and E B (ti|lR2i) that are sent from the user apparatus to the 

20 quantitative competition apparatuses 1 5 A and 1 5B~this provides the 
advantage of decreasing the channel capacity. 

In the case of sending the hash values for verification use 
Hli=h(Si||R10 and H2j=h(tj||R2;) to the bulletin board apparatus 21, too, the 
random numbers Rli and R2i are intended to increase security, and hence 

25 they need not always to be used. Accordingly, the hash values can be sent as 
Hli=h(si) and H2j=h(tj) to the bulletin board apparatus 21. 

Further, the above embodiments have been described to use the 
one-way functions for comparing the element concatenations Seq s>w and Seq t , w 
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without revealing their values, but it is also possible to encrypt the 
concatenations Seq S;W and Seq t;W by the same key and send the encrypted 
values to the bulletin board apparatus 21 for comparison. 

In the first and third embodiments, for example, in the case of 
5 calculating the minimum value, it is possible to use a predetermined common 
one-way function for the two sequences of information s; and t ; that are 
generated in the information sequence generating part 33 and determine seed 
values s'j and t'j that provide F d (s'j>£F d (t'j) (where d=0, 1, M-vi) and 
F e (s'i)*F e (t'i) (where e=M-vi+l, . . ., M-l) for the intended value. For 
1 0 example, F 3 (s' ; ) is a multi-function representing F(F(F(s'j))). Accordingly, 
the sequences of information Sj and t s become as follows: 
sHs u =F*-Vi), s i;2 =F M - 2 (s'i), .... s^-F^VD, Si,vi=F M - vi (s'0, .... 
Si 5 M-l=F(s'i), s ijM =s'i} 

tHtu-F^Ct'O, ti,2=F M - 2 (t'i), tj^F^^t'j), ti , vi =F M - vi (t' ; ), 

15 ti.M-^FO'O, t i>M =s'i} 

With this sequence generating scheme, when the seed values s'j and t' i; all the 
elements s i( i, . . ., s isM and t u , t lM can be calculated using the common 
one-way function. Accordingly, all the elements of the sequences of 
information S\ and tj need not be incorporated in the encrypted sequences of 

20 information E A (si||Rlj) and E B (tj||R2i) that are sent from the user apparatus to 
the quantitative competition apparatuses 15Aand 15B, but instead by sending 
the encrypted sequences of information with only seed values s',- and t'j 
incorporated therein, that is, E A (s'j||Rli) and E B (t'j||R2j), the quantitative 
competition apparatuses 15A and 15B can generate the sequences of 

25 information s; and tj from the seed values s'j and t'j through utilization of the 
common one-way function F. 

A description will be given of how to determine the multi-function 
F(x) for generating the sequences of information Sj and tj based on the seed 
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values s'j and t'; and the seed values. 

The user apparatus 11-i calculates primes p and q of proper sizes and 
calculates a composite number n=p*q. The composite number n is one that 
us used in the RSA cryptosystem based on the factoring problem. From the 
5 security point of view, it is preferable that the primes p and q have sizes of 
about 512 or 1024 bits and that p-1 and q-1 have large prime factors. 

Then, the user apparatus 11-i generates random numbers a k of values 
in the range of between 0 to n-1 for k=0 to m, and creates a polynomial 

F(x) = a m *x m + a m _! *x m_1 + . . . + ai*x + a 0 . 
1 0 Next, the user apparatus 11-i generates random numbers s'j and t'j of values in 
the range of between 0 and n-1 , and set them as the seed values. After this, 
the user apparatus finds out a collision with F(x) mod n, for example, by such 
a scheme as described below. 

Step 1 : calculate F u (s'i)mod n for u=l,2, . . ., c, and stores the results of 
15 sequential calculations F(s',), F 2 (s'j), . . ., F c (s'j), where c is a parameter that 
the user determines and F u (x) is a u-fold multi-function. 

Step 2: Set flag=0, v=0 and mx=c', where c' is a parameter that the 
user determines. 

Step 3: Calculates F v (t'i)mod n, then stores the result of calculation, 
20 then makes a check to see if the calculated value matches any one of the 
values F(s'i), F 2 (s'j), F°(s'i) stored in step 1, and if any, set flag=L 
Step 4: If flag=l or v=c\ discontinue the procedure, or if not, 
increment v by one and return to step S3. 

In this case, the final state of flag=l is equivalent to the detection of a 
25 collision. In general, however, since F(x) mod n covers a wide range 

(approximately 1024 or 2048 bits), it is expected that the collision will not 
readily be found. By selecting a natural number n' smaller than n and 
replacing the original output F(x) mod n with (F(x) mod n) mod n' so as to 
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reduce the value of F(x) mod n to a narrow range, the collision could be 
detected with more ease. In this case, for example, (35 mod 15) mod 3 is 5 
mod 3=2. At any rate, the following description will be given on the 
assumption that the collision has been detected. 

Assuming that F u>_1 (s' i )^F v '" 1 (t' i ), F u '(s' i )=F v '(t' i ), and the intended 
value V vi is w-th counted from the minimum value Vi, the sequences of 
information Sj and X { can be constructed if M-w+ 1 <u' and M-w+ 1 <v ' . That 
is, the sequences of information need only to be set as follows: 

Si={s u =F u,+w - 2 (s'i), .... s^'-Vi), s^'^-^s'O} 
ti={ty=F u ' +w - 2 (t'i), ...t^F^CtU ...^F^^Ct'O} 
Incidentally, the reason for which the composite number n, relying on 
the factoring problem, is used in mod n is to inhibit easy factorization of a 
polynomial F'(x)=F(x)/(x-x') when the constant x' is present. For example, 
noting an element S\x of the sequence of information s;, it can be seen that the 
intended value of the user 1 1-i is not V k when there is present only one z that 
satisfies F(z)=s k mod n. 

With the above-mentioned collision search scheme, since there is a 
fear of leakage of information about the intended value, care should be taken 
in choosing the number n'. Conversely, when the conditions of the 
sequences of information Sj and tj are not met, collision search steps 1 to 4 
need only to be performed again. 

A hash function may be used as the function F(x). In such an 
instance, too, it is expected that the collision cannot readily be detected, but 
by reducing the output to a narrow range by the above-described scheme, the 
collision can be detected with ease. In some cases, however, it may become 
necessary to pad the input in association with the size of the output to be 
reduced. 

With the method of sending only the seed value as described above, it 
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is possible to reduce the channel capacity and communication time for 
sending the sequence of information to each quantitative competition 
apparatus. Further, even if the number M of values choosable as the 
intended value V vi is increased, the channel capacity remains unchanged since 
5 only the seed value is sent. On the other hand, in the case of using random 
numbers to generate the sequences of information as in the first embodiment, 
as the number M of values choosable as the intended value, the number of 
elements of each sequence of information increases accordingly, causing an 
increase in the channel capacity. 

10 In the case of calculating the maximum value, too, all the elements of 

each sequence of information may be generated from the seed value through 
the use of the one-way function. 

While the above embodiments determine the minimum value V M in 
among all of the users' intended values V vi , the maximum intended value 

1 5 Vmax can similarly be determined. In this instance, the two sequences of 
information Si and tj are adapted so that they differ in the information 
corresponding to the values equal to or greater than Vi and equal to or smaller 
than Vvi and that they are common in the information corresponding to the 
values equal to or greater than V vi+ i and equal to or smaller than V M - Further, 

20 in the comparisons between Seq s , w and Seq tw , between HS w =h'(Seq s , w ) and 
HT w =h'(Seq t , w ), and between (HT^^mod P and (HS w RA T Bw mod P 
which correspond to the chosen value w, if they differ, it is judged that there is 
a user who has committed his intended value equal to or larger than V w , and if 
they equal, it is judged that there is no user who has committed his intended 

25 value equal to or larger than V w . When they equal, w-1 is substituted for 
w max , and when they differ, w is substituted for w min , after which the same 
processing as described above needs only to be repeated. 

By determining the value w in the manner described above, the 



-32- 



minimum or maximum value can be calculated efficiently, but the quantitative 
competition may also be conducted, for example, by sequentially changing 
the value w from the value Vi or V M . Moreover, it is also possible that one 
quantitative competition apparatus determines the first value of w, sends it via 
5 the bulletin board apparatus 21 to the other quantitative competition apparatus, 
then receives necessary information from the bulletin board apparatus 21, and 
performs the processing shown in Fig. 7. 

EFFECT OF THE INVENTION 

1 0 As described above, the present invention permits implementation of a 

highly invulnerable quantitative competition method in which simply by 
sending from the user the information about his intended value to each 
quantitative competition apparatus and the bulletin board apparatus only once, 
the maximum or minimum value can be specified efficiently and, if necessary, 

1 5 only the user having committed the maximum or minimum value as his 
intended value can be specified. 



